6009 Commits

Author	SHA1	Message	Date
frack113	dde3b17c20	split global win_mal_service_installs.yml	2021-09-21 16:17:59 +02:00
frack113	518d294ee9	fix id error	2021-09-21 16:06:27 +02:00
frack113	b9d14ef55a	split global win_metasploit_or_impacket_smb_psexec_service_install.yml	2021-09-21 16:02:47 +02:00
frack113	9dbc71ca2f	split global win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml	2021-09-21 15:50:06 +02:00
frack113	0dd549ba67	fix selection name	2021-09-21 15:25:03 +02:00
frack113	7c8d1ab037	split global win_moriya_rootkit.yml	2021-09-21 15:18:25 +02:00
frack113	a4ad7e5358	split global win_net_ntlm_downgrade.yml	2021-09-21 15:10:08 +02:00
frack113	a5c8fba7a5	fix error	2021-09-21 15:01:51 +02:00
frack113	20a785bad3	split global win_powershell_script_installed_as_service.yml	2021-09-21 13:55:04 +02:00
frack113	8c13bd23b9	split global win_powershell_web_request	2021-09-21 13:44:19 +02:00
frack113	ba3c7a020a	split global win_root_certificate_installed.yml	2021-09-21 13:34:32 +02:00
frack113	6368a88ad3	split global win_software_discovery.yml	2021-09-21 13:28:47 +02:00
frack113	332bed7906	split global win_susp_eventlog_cleared.yml	2021-09-21 13:22:40 +02:00
frack113	99f24a95a6	split global win_susp_failed_logons_single_source.yml	2021-09-21 13:19:00 +02:00
frack113	06ed7c41af	split clobal win_tap_driver_installation.yml	2021-09-21 13:15:21 +02:00
frack113	5951ad1d9a	Merge pull request #2056 from frack113/some_global ... Split global rules	2021-09-21 12:42:59 +02:00
frack113	d5e1e97ed3	Merge pull request #2055 from frack113/split_invoke ... split global win_invoke_obfuscation_*	2021-09-21 12:42:41 +02:00
frack113	0884a70e28	fix tests.py error	2021-09-21 10:52:37 +02:00
frack113	4718f914e9	split global sysmon_hack_dumpert.yml	2021-09-21 10:43:42 +02:00
frack113	5fc82e5dc6	split global sysmon_tttracer_mod_load.yml	2021-09-21 10:39:02 +02:00
frack113	4c85858e12	split global sysmon_regsvr32_network_activity.yml	2021-09-21 10:33:47 +02:00
frack113	c0e24e9236	split global win_defender_disabled.yml	2021-09-21 10:24:52 +02:00
frack113	2b23118b0d	split global win_defender_exclusions.yml	2021-09-21 10:16:25 +02:00
frack113	318f8b714e	split global win_tool_psexec.yml	2021-09-21 10:10:48 +02:00
frack113	a96dd66b46	split global win_wmi_persistence.yml	2021-09-21 09:56:03 +02:00
frack113	0a6ac0b171	split global powershell_alternate_powershell_hosts.yml	2021-09-21 09:52:35 +02:00
frack113	f5d58a0cb1	split powershell_remote_powershell_session.yml	2021-09-21 09:48:50 +02:00
frack113	95af26f963	split powershell_suspicious_download.yml	2021-09-21 09:46:02 +02:00
frack113	10d11b7890	fix 4697 fieldname	2021-09-20 22:53:59 +02:00
frack113	b6dc4de5e1	split global win_invoke_obfuscation_*	2021-09-20 22:42:59 +02:00
frack113	feee70644f	split global win_invoke_obfuscation_*	2021-09-20 22:40:33 +02:00
neu5ron	61c9c9fb20	Zeek detection for OMIGOD HTTP RCE ... Signed-off-by: neu5ron <neu5ron@users.noreply.github.com>	2021-09-20 12:26:01 -04:00
Florian Roth	a18f4d3c10	Merge pull request #2053 from humpalum/master ... Rule for ADSelfService cve_2021_40539	2021-09-20 16:41:52 +02:00
frack113	6dbc369eb5	Update web_cve_2021_40539_adselfservice.yml	2021-09-20 15:51:21 +02:00
frack113	4424bc9c5d	Update web_cve_2021_40539_adselfservice.yml	2021-09-20 13:20:39 +02:00
Florian Roth	56069a2196	Update web_cve_2021_40539_adselfservice.yml	2021-09-20 13:07:31 +02:00
Florian Roth	8909eefb90	Merge pull request #2052 from phantinuss/pr ... xwizard dll sideloading	2021-09-20 12:35:42 +02:00
Tobias Michalski	2b843e58ee	fix: added references	2021-09-20 12:28:47 +02:00
Tobias Michalski	79d2144424	feat: Rule for ADSelfService cve_2021_40539	2021-09-20 12:26:46 +02:00
phantinuss	25a407e24f	Update win_dll_sideload_xwizard.yml	2021-09-20 10:56:37 +02:00
Florian Roth	6c630502dc	Update win_dll_sideload_xwizard.yml	2021-09-20 10:54:53 +02:00
frack113	91788e57c7	Merge pull request #2051 from frack113/double_file_name ... fix duplicate name file	2021-09-20 10:45:35 +02:00
phantinuss	4e794fe3e7	xwizard dll sideloading	2021-09-20 10:39:31 +02:00
frack113	6286cf80cc	fix duplicate name file	2021-09-20 09:31:04 +02:00
frack113	d5108502a2	split win_apt_chafer_mar18.yml	2021-09-19 11:48:20 +02:00
frack113	faff9e6db7	spli win_apt_slingshot.yml	2021-09-19 11:36:40 +02:00
frack113	e69ec4624a	split win_apt_gallium.yml	2021-09-19 11:24:17 +02:00
frack113	c43c12e557	split win_apt_turla_commands.yml	2021-09-19 11:17:50 +02:00
frack113	b576ad115b	split win_apt_unidentified_nov_18.yml	2021-09-19 11:11:04 +02:00
frack113	06de91c92a	split win_apt_wocao.yml	2021-09-19 11:07:24 +02:00